CVE-2026-86434 Overview
CVE-2026-86434 is a denial of service vulnerability in the league/commonmark PHP Markdown parser. The flaw affects versions >= 2.0.0 and < 2.8.4, with a fix delivered in 2.9.0. The vulnerable code resides in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision. This produces O(K^2) time complexity when K headings collapse to the same base slug. The vulnerable path activates when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. Unauthenticated attackers can trigger excessive CPU consumption using a small Markdown document, categorized under [CWE-407] Algorithmic Complexity.
Critical Impact
An unauthenticated attacker can exhaust CPU resources on any web application that renders untrusted Markdown with the affected extensions enabled, denying service to legitimate users.
Affected Products
- league/commonmark versions >= 2.0.0 and < 2.8.4
- Applications using HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension
- Downstream PHP applications and frameworks bundling vulnerable releases
Discovery Timeline
- 2026-09-07 - CVE-2026-86434 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-86434
Vulnerability Analysis
The vulnerability is an algorithmic complexity flaw in the slug uniqueness logic used by league/commonmark heading extensions. When rendering headings, the library generates URL-safe slug identifiers. If two headings produce the same base slug, UniqueSlugNormalizer::normalize() appends a numeric suffix to deduplicate them.
The implementation restarts the suffix search from 1 for each new collision. Every subsequent duplicate must scan through all previously assigned suffixes before finding an unused value. Processing K colliding headings therefore performs work proportional to K^2. Small Markdown payloads containing thousands of empty ATX headings or identical heading text can consume seconds of CPU per request, denying service to legitimate users.
Root Cause
The root cause is inefficient state tracking in UniqueSlugNormalizer::normalize(). The function does not cache the highest suffix assigned per base slug. Instead it iterates from 1 on every call, producing quadratic time complexity as duplicates accumulate.
Attack Vector
The attack requires no authentication and is remotely exploitable over the network. An attacker submits a Markdown document containing many headings that collapse to the same base slug. Empty ATX headings (#, ##), identical heading text, and punctuation-only headings all normalize to identical slugs. Any endpoint that accepts user-supplied Markdown and renders it with the vulnerable extensions is exposed. Refer to the GitHub Security Advisory and the VulnCheck Advisory on Denial of Service for a detailed breakdown.
Detection Methods for CVE-2026-86434
Indicators of Compromise
- Sustained high CPU utilization on PHP-FPM or worker processes handling Markdown rendering endpoints.
- HTTP request bodies containing hundreds or thousands of repeated # headings, identical heading text, or punctuation-only headings.
- Elevated request latency and worker timeouts on comment, wiki, or issue-tracker endpoints that accept Markdown.
Detection Strategies
- Inspect application logs for slow requests correlated with Markdown submission endpoints and unusually large heading counts.
- Deploy web application firewall (WAF) rules that count heading tokens in POST bodies and flag payloads exceeding a defined threshold.
- Run a dependency inventory to identify installations of league/commonmark between 2.0.0 and 2.8.3.
Monitoring Recommendations
- Track CPU time per request for endpoints invoking CommonMarkConverter or MarkdownConverter.
- Alert on repeated 502 or 504 responses from reverse proxies fronting PHP workers.
- Monitor process-level resource usage for PHP workers exceeding baseline execution time.
How to Mitigate CVE-2026-86434
Immediate Actions Required
- Upgrade league/commonmark to 2.9.0 or later using composer update league/commonmark.
- Audit all applications and bundled dependencies that transitively include league/commonmark.
- Enforce short PHP execution time limits on endpoints that render user-supplied Markdown.
Patch Information
The maintainers patched the flaw in league/commonmark2.9.0. Version 2.8.4 also contains the fix. Consult the GitHub Security Advisory GHSA-mh25-x5hq-wrqp for release notes and upgrade guidance.
Workarounds
- Disable HeadingPermalinkExtension, FootnoteExtension, and TableOfContentsExtension if they are not required.
- Enforce a maximum request body size and reject Markdown documents exceeding a reasonable heading count before parsing.
- Apply rate limiting on endpoints that render user-supplied Markdown to reduce abuse potential.
# Upgrade league/commonmark to a patched release
composer require league/commonmark:^2.9.0
composer show league/commonmark
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
